Application security issues found by Assetnote

On August 24th, 2022, we reported a vulnerability to Netlify affecting their Next.js "netlify-ipx" repository which would allow an attacker to achieve persistent cross-site noscripting...

Understanding the operation and limitations of Sysmon's first preventive mechanism: the FileBlockExecutable event.

We take a deep dive into Roshtyak, the DLL backdoor payload associated with Raspberry Robin. Roshtyak is full of anti-analysis tricks. Some are well-known, and some we have never seen before. From a technical perspective, the lengths Roshtyak takes to protect…

HTTP header injection is often under-estimated and misclassified as a moderate severity flaw equivalent to XSS or worse, Open Redirection. In this post, I'll share a simple technique I used to take a

A string of recent attacks has made it clear that ‘classic’ ways of doing MFA are not sufficient. This guide provides instructions for setting up a MacBook Pro’s Touch ID fingerpr…

tl;dr You can now have Scout Suite scan not only your cloud environments, but your Kubernetes clusters. Just have your kubeconfig ready and run the following commands: $ pip3 install –user $ …

Last year, we (My researcher partner on this topic, Anil and me) and found a SQL injection vulnerability on a target at Synack which was…

μετάμάσκα - malevolent payload classifier. Contribute to dogancanbakir/metamaska development by creating an account on GitHub.

based on findings from a live hacking event

When a customer asks for a solidity audit, we need a proper estimation of the required hours to complete the task in order to schedule it. In order to do

HTTP Request Smuggling in NodeJS

Shortly before 12:00 PM UTC on September 23, 2022, our platform alerted us to a malicious package publication for packages owned by dYdX.

Should Privileges Required be set as “Low” when an application has open registration? Common wisdom says yes, but the specification disagrees.

PoC for a new sleep obfuscation technique leveraging waitable timers to evade memory scanners. - GitHub - Idov31/Cronos: PoC for a new sleep obfuscation technique leveraging waitable timers to evad...

Static analysis tool based on clang, which detects source-to-binary information leaks in C and C++ projects - GitHub - ergrelet/cpplumber: Static analysis tool based on clang, which detects source-...